{"id":"02d1d718-dd13-41af-989d-ea85c7fab93f","title":"Rare Remote Thread Creation By Uncommon Source Image","description":"Detects uncommon processes creating remote threads.","author":"Perez Diego (@darkquassar), oscd.community","status":"test","level":"high","date":"2019-10-27","modified":"2025-12-08","tags":["attack.privilege-escalation","attack.stealth","attack.t1055"],"technique_ids":["T1055"],"logsource":{"product":"windows","category":"create_remote_thread"},"falsepositives":["This rule is best put in testing first in order to create a baseline that reflects the data in your environment."],"references":["Personal research, statistical analysis","https://lolbas-project.github.io"],"source_path":"rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml","source_sha256":"09d0de94349cbc1cd3817cb120e0c9c76174abe5c693ea0a1d5f671bc413f1f0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Rare Remote Thread Creation By Uncommon Source Image\nid: 02d1d718-dd13-41af-989d-ea85c7fab93f\nrelated:\n    - id: 66d31e5f-52d6-40a4-9615-002d3789a119\n      type: derived\nstatus: test\ndescription: Detects uncommon processes creating remote threads.\nreferences:\n    - Personal research, statistical analysis\n    - https://lolbas-project.github.io\nauthor: Perez Diego (@darkquassar), oscd.community\ndate: 2019-10-27\nmodified: 2025-12-08\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1055\nlogsource:\n    product: windows\n    category: create_remote_thread\ndetection:\n    selection:\n        SourceImage|endswith:\n            - '\\bash.exe'\n            - '\\cscript.exe'\n            - '\\cvtres.exe'\n            - '\\defrag.exe'\n            - '\\dialer.exe'\n            - '\\dnx.exe'\n            - '\\esentutl.exe'\n            - '\\excel.exe'\n            - '\\expand.exe'\n            - '\\find.exe'\n            - '\\findstr.exe'\n            - '\\forfiles.exe'\n            - '\\gpupdate.exe'\n            - '\\hh.exe'\n            - '\\installutil.exe'\n            - '\\lync.exe'\n            - '\\makecab.exe'\n            - '\\mDNSResponder.exe'\n            - '\\monitoringhost.exe' # Loads .NET CLR by default and thus a favorite for process injection for .NET in-memory offensive tools.\n            - '\\msbuild.exe'\n            - '\\mshta.exe'\n            - '\\mspaint.exe'\n            - '\\outlook.exe'\n            - '\\ping.exe'\n            - '\\provtool.exe'\n            - '\\python.exe'\n            - '\\regsvr32.exe'\n            - '\\robocopy.exe'\n            - '\\runonce.exe'\n            - '\\sapcimc.exe'\n            - '\\smartscreen.exe'\n            - '\\spoolsv.exe'\n            - '\\tstheme.exe'\n            - '\\userinit.exe'\n            - '\\vssadmin.exe'\n            - '\\vssvc.exe'\n            - '\\w3wp.exe'\n            - '\\winscp.exe'\n            - '\\winword.exe'\n            - '\\wmic.exe'\n            - '\\wscript.exe'\n    filter_main_conhost:\n        SourceImage:\n            - 'C:\\Windows\\System32\\Defrag.exe'\n            - 'C:\\Windows\\System32\\makecab.exe'\n        TargetImage: 'C:\\Windows\\System32\\conhost.exe'\n    filter_main_provtol_svchost:\n        SourceImage: 'C:\\Windows\\System32\\provtool.exe'\n        TargetImage: 'C:\\Windows\\System32\\svchost.exe'\n    filter_main_provtool_system:\n        SourceImage: 'C:\\Windows\\System32\\provtool.exe'\n        TargetImage: 'System'\n    filter_main_userinit:\n        SourceImage: 'C:\\Windows\\System32\\userinit.exe'\n        TargetImage: 'C:\\Windows\\explorer.exe'\n    filter_main_winword:\n        SourceImage|endswith: '\\WINWORD.EXE'\n        TargetImage|startswith:\n            - 'C:\\Program Files (x86)\\' # C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n            - 'C:\\Program Files\\' # C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Office16\\AI\\ai.exe\n    filter_main_ms_office:\n        # Raised by following issue: https://github.com/SigmaHQ/sigma/issues/5529\n        SourceImage|startswith:\n            - 'C:\\Program Files\\Microsoft Office\\'\n            - 'C:\\Program Files (x86)\\Microsoft Office\\'\n        TargetImage: 'System'\n    filter_optional_explorer_vmtools:\n        SourceImage|endswith: '\\SysWOW64\\explorer.exe'\n        TargetImage:\n            - 'C:\\Program Files (x86)\\VMware\\VMware Tools\\vmtoolsd.exe'\n            - 'C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - This rule is best put in testing first in order to create a baseline that reflects the data in your environment.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055","id":"T1055","name":"Process Injection","page":"techniques/enterprise/T1055/"}],"data_path":"data/detection-rules/02d1d718-dd13-41af-989d-ea85c7fab93f.json","kind":"sigma"}